Tags: yawkat/lz4-java
Tags
Fix remaining ArrayIndexOutOfBoundsExceptions in LZ4DecompressorTest (#6 ) An ArrayIndexOutOfBoundsException could indicate either an out-of-bounds access, or invalid arguments (e.g. offset < 0). Since we want to detect the former in the fuzz tests, we need to make sure the latter doesn't happen. This PR: - Disables the ArrayIndexOutOfBoundsException catch so that it's reported by the fuzzer - Fixes a bug in the test where the src length was larger than allowed - Adjusts the LZ4JNIFastDecompressor to throw an LZ4Exception on empty input rather than an ArrayIndexOutOfBoundsExceptions (made by @Marcono1234; not security relevant, this only changes the exception. LZ4JNIFastDecompressor is also disabled by default due to CVE-2025-12183) With these changes, a quick fuzz run now only shows the native_fast_* tests failing, both with a segfault, which is expected due to CVE-2025-12183.
PreviousNext